This endpoint allows partial updates to an existing AIE rule. Only the fields included in the request payload will be updated. All other fields will remain unchanged.
All requests are validated before updates are applied. If validation fails, the update request will be rejected.

General Behavior:

• All requests are validated before updates are applied.
• Fields not included in the request remain unchanged.

User Profile and Privileges:

• Users must have AIE Rule Update/Edit privilege to modify a rule.
• Requests from users without the required privilege will return an authorization error.
• Rule updates may be restricted based on the user's profile permissions.

Rule Name Synchronization:

• If syncWithRuleName = true:

  • information.ruleName is required.
  • The system automatically prefixes the rule name with "AIE:".

• If syncWithRuleName = false:

  • commonEvent.commonEventId must be provided.
  • The rule links to the specified Common Event.

Alarm Configuration:

• If only alarmOnEventOccurrence is provided:

  • alarmAutoDrillDown is automatically set to the same value.

• If both values are provided:

  • alarmAutoDrillDown can be true or false only when alarmOnEventOccurrence = true.

Event Forwarding:

• If enableEventForwarding = false, the following fields will be ignored:
  • notify
  • decimalPlaces
  • alarmOnEventOccurrence
  • alarmAutoDrillDown

Event Suppression:

• If enableSuppression = true and suppressionMultiple is not provided:

  • suppressionMultiple will default to 1.

• Set enableSuppression = false to disable suppression.

Expiration Date:

• Must be a future date.
• Past dates are not allowed.
• Pass null to remove the expiration date.
• If omitted, the current value remains unchanged.

Nullable Text Fields:

• Fields: briefDesc, additionalDetails, ruleGroup
• Pass null to clear the value.
• If omitted, the current value remains unchanged.

RuleBlocks Configuration:

The ruleBlocks array allows you to define or update the detection logic for the AIE rule. Each rule can have 1 to 3 rule blocks that work together to detect complex patterns.

General Rules:

• Minimum: 1 rule block is required when ruleBlocks is provided
• Maximum: 3 rule blocks are allowed per rule
• Block Order: Rule blocks are processed in sequence (blockId: 0, 1, 2)
• Block IDs: Must be sequential starting from 0 (e.g., 0, 1, or 0, 1, 2)

Rule Block Types and Restrictions:

Block Composition Rules:

• Single Block Rules (1 block):

  • Can use: LogObserved, LogNotObservedScheduled, ThresholdObserved, ThresholdNotObservedScheduled, UniqueValuesObserved, UniqueValuesNotObservedScheduled, WhiteList, Statistical, Trend
  • Cannot use: LogNotObservedCompound, ThresholdNotObservedCompound, UniqueValuesNotObservedCompound (these require a preceding block)

• Two Block Rules (2 blocks):

  • First block must be: LogObserved, ThresholdObserved, UniqueValuesObserved, or WhiteList
  • Second block can be: Any NotObservedCompound type or Observed type

• Three Block Rules (3 blocks):

  • First block must be: LogObserved, ThresholdObserved, UniqueValuesObserved, or WhiteList
  • Second block must be: Observed type only (not *NotObserved)
  • Third block can be: Any NotObservedCompound type or Observed type

Required Properties Per Block:

Common Required Properties (All Blocks):

• ruleBlockType: Type discriminator (must match one of the supported types)
• blockId: Sequential ID starting from 0
• dataSource: Data source configuration
  • dataSourceId: Must be 1 (DataProcessorLogs) or 101 (AdvancedIntelligenceEngineEvents)
• filter_MsgFilters: At least one message filter required (cannot be empty)
  • Each filter requires fieldFilters array
  • Each fieldFilter requires fieldFilterValues array (unless filtering null values)
  • sortOrder must be sequential starting from 0

GroupBy Fields:

• Required for: ThresholdObserved, ThresholdNotObservedCompound, UniqueValuesObserved, UniqueValuesNotObservedCompound, WhiteList
• Cannot be duplicate within the same block
• Cannot use both Entity and RootEntity when dataSegregationMode is enabled
• Cannot use SLocationCountry, SLocationRegion, and SLocation together (choose only one)

Rule Block Relationships (Blocks 1 and 2):

• ruleBlockRelationship is required for blockId 1 and 2
• Properties:
  • ruleBlockA_GUID: GUID of the preceding block
  • ruleBlockB_GUID: GUID of the current block
  • durationOffsetSeconds: Must be 0 for the first relationship
  • durationSeconds: Must be ≥ 60 for subsequent blocks
  • fieldRelationships: Array of field links between blocks
    • ruleBlockA_Field: Must exist in preceding block's groupByFields
    • ruleBlockB_Field: Must exist in current block's groupByFields
  • joinType: Valid values: "0" (Inner), "1" (LeftOuter), "2" (RightOuter), "3" (FullOuter)

Type-Specific Properties:

• ThresholdObserved / ThresholdNotObservedCompound / ThresholdNotObservedScheduled:

  • thresholdFields: Required, at least one threshold definition
    • field: Field to count (must be a supported threshold field)
    • thresholdCount: Count threshold (must be > 0)

• UniqueValuesObserved / UniqueValuesNotObservedCompound / UniqueValuesNotObservedScheduled:

  • distinctOccurrenceFields: Required, exactly one unique value field
    • field: Field to track unique values (must be supported)
    • count: Occurrence count (must be > 0)
  • Important: The unique value field cannot also be in groupByFields

• NotObservedScheduled Types (LogNotObservedScheduled, ThresholdNotObservedScheduled, UniqueValuesNotObservedScheduled):

  • scheduleConfig: Required schedule configuration
    • timeZoneId: Valid timezone ID (e.g., "India Standard Time")
    • evaluationTimeSpan: Time interval for evaluation (required unless autofrequency is true)
    • autofrequency: Boolean, auto-calculate evaluation frequency
    • monitoringIntervals: Optional day/time filters
  • filter_DistinctOccurrence: Required for NotObservedScheduled types
    • fieldFilterType: Must be a supported distinct occurrence filter

• WhiteList:

  • linkedDataBlocks: Required, at least one linked data block
    • Each linked block must have groupByFields
    • All common groupByFields must be included in ruleBlockRelationship.fieldRelationships

• Statistical:

  • scheduleConfig: Required (same as NotObservedScheduled)
  • statisticalConfig: Optional filtering criteria
  • groupByFields: Recommended for statistical calculations

• Trend:

  • linkedDataBlocks: Required, at least one linked data block
  • scheduleConfig: Required (same as NotObservedScheduled)

Data Source Restrictions:

• When dataSourceId = 101 (AdvancedIntelligenceEngineEvents):
  • filter_LogSources must be empty or null
  • filter_LogSourceLists must be empty or null

Log Source Filter Rules:

• Cannot use both filter_LogSources and filter_LogSourceLists in the same block
• Choose one: individual log sources OR log source lists, not both

Day and Time Filters (filter_DayAndTime):

• timeZoneId: Required, must be a valid timezone
• dayTimeStartLocal and dayTimeEndLocal: Both required
  • day: Day of week (0=Sunday to 6=Saturday)
  • displayTime: 12-hour format with AM/PM (e.g., "9:00 AM")

AIE Summary Fields (aieSummaryFields):

• Optional, but cannot contain duplicates
• Cannot contain fields that are in groupByFields or related to groupByFields

Data Segregation Impact:

• When dataSegregationMode is set to "logSourceEntity" (1) or "logSourceRootEntity" (2):
  • NotObservedScheduled types are not supported
  • Cannot explicitly include Entity or RootEntity in groupByFields
  • The system automatically adds Entity or RootEntity to grouping logic

Message Filter Validation (filter_MsgFilters):

• Each message filter requires:
  • fieldFilters array with at least one filter
• Each fieldFilter requires:
  • fieldFilterType: The field type being filtered
  • filterMode: "FilterIn" (0) or "FilterOut" (1)
  • fieldFilterValues: Array of filter values (required unless filtering null values)
  • filterInNullValues and filterOutNullValues: Cannot both be true
• For Application filters: supported fieldFilterTypes are KnownService, DPort, DPortRange, Protocol
• For Host filters: supported fieldFilterTypes are KnownHost, IP, IPRange, SHostName, MAC, NATIP, NATIPRange

Field Filter Sequence:

• The sequence of FieldFilter entries is determined by the order in which they are provided in the request body. To modify the sequence, update the order of the fields in the request body and resubmit the request. The system will apply the sequence accordingly.

Enum Fields:
These fields accept either integer values or camelCase string values.

riskRating / fpp:

• none (0)
• lowLow (1)
• lowMedium (2)
• lowHigh (3)
• mediumLow (4)
• mediumMedium (5)
• mediumHigh (6)
• highLow (7)
• highMedium (8)
• highHigh (9)

runtimePriority:

• low (0)
• normal (1)
• high (2)

edf:

• none (0)
• low (1)
• medium (2)
• high (3)

dataSegregationMode:

• none (0)
• logSourceEntity (1)
• logSourceRootEntity (2)